Security Resilience

CVE-2025-61971

Published
13 May 2026
Modified
17 June 2026
CVSS Score v4 5.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0012 1th percentile
Risk Priority 20 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-61971 is a medium-severity Security-Sensitive Hardware Controls with Missing Lock Bit Protection (CWE-1233) vulnerability in Amd (inferred from references). Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique System Firmware (T1542.001); ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to modify MMIO routing configurations, potentially resulting in loss of SEV-SNP guest integrity.

CWE(s)
CWE-1233

Related Threats

MITRE ATT&CK Enterprise Techniques

T1542.001 System Firmware Stealth
Adversaries may modify system firmware to persist on systems.
attack.mitre.org →
T1495 Firmware Corruption Impact
Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or…
attack.mitre.org →
T1542 Pre-OS Boot Stealth
Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.
attack.mitre.org →
T1542.002 Component Firmware Stealth
Adversaries may modify component firmware to persist on systems.
attack.mitre.org →
T1601 Modify System Image Defense Impairment
Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-25733Shared CWE-1233
CVE-2025-61972Shared CWE-1233
CVE-2025-25735Shared CWE-1233
CVE-2025-25734Shared CWE-1233

Affected Assets

Amd
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

AC-3 directly requires enforcement of authorizations that would stop unauthorized writes to lock-bit-protected hardware registers.

AC-6 Least Privilege good match

Least privilege limits which subjects may alter security-sensitive configuration registers even when lock bits are present.

CM-5 Access Restrictions for Change good match

CM-5 mandates documented and enforced access restrictions on changes to system configuration, covering hardware register lock mechanisms.

SC-3 Security Function Isolation partial match

Isolating security functions reduces the attack surface for tampering with hardware configuration registers protected by lock bits.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
blocks

Hardened configuration baselines and verification directly enforce lock-bit settings on security-sensitive registers.

ID.RA-09 partial match
blocks

Pre-acquisition integrity checks can identify hardware lacking effective register lock-bit controls.

PR.PS-03 partial match
blocks

Hardware replacement decisions can address devices lacking functional lock-bit protection.

References